Skip to content

[FIX] Treat NULL as empty in the Levenshtein FFI exports - #2391

Merged
cfsmp3 merged 1 commit into
masterfrom
fix/levenshtein-null-slice
Oct 18, 2026
Merged

cfsmp3 merged 1 commit into
masterfrom
fix/levenshtein-null-slice

Conversation

@cfsmp3

@cfsmp3 cfsmp3 commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

In raising this pull request, I confirm the following (please check boxes):

Reason for this PR:

  • This PR adds new functionality.
  • This PR fixes a bug that I have personally experienced or that a real user has reported and for which a sample exists.
  • This PR is porting code from C to Rust.

Sanity check:

  • I have read and understood the contributors guide.
  • I have checked that another pull request for this purpose does not exist.
  • If the PR adds new functionality, I've added it to the changelog. If it's just a bug fix, I have NOT added it to the changelog.
  • I am NOT adding new C code unless it's to fix an existing, reproducible bug.

Repro instructions:

Build with ./build -debug and run ccextractor b8c55aa2e9f27f1355c3b7848e513474a78d1efb56973134fd9f665e6c86a2ef.mpg --tpages-all -o out.srt (teletext sample). It aborts:

unsafe precondition(s) violated: slice::from_raw_parts requires the pointer to be aligned and non-null
(panicked at src/libccxr_exports/mod.rs:105:14)

Release builds don't check the precondition, so there it is silent undefined behaviour.


C represents an empty compare buffer as (NULL, 0): telxcc.c resets ucs2_buffer_cur to NULL after every buffer switch, and process_page() → fuzzy_memcmp() passes it to levenshtein_dist() when a page carried no text. That's fine in C, but slice::from_raw_parts requires a non-null pointer even for a zero length, so ccxr_levenshtein_dist() was UB.

The slices are now built through a helper that maps NULL to an empty slice; ccxr_levenshtein_dist_char() uses it too, since it has the same hazard. The Safety docs say NULL denotes an empty slice.

Verified:

  • New unit tests call both exports with null pointers / zero lengths. Without the fix the test binary aborts on the same precondition; with it they pass.
  • The debug build no longer aborts on the sample above (all 9 page files written).
  • 108 teletext runs (platform commands, --teletext, --tpages-all srt/webvtt across 29 samples): release output and exit codes byte-identical to master.
  • cargo test, cargo fmt --check and cargo clippy -D warnings clean in both crates.

C represents an empty compare buffer as (NULL, 0): telxcc resets
ucs2_buffer_cur to NULL after each buffer switch, and fuzzy_memcmp()
passes it on to levenshtein_dist() when a page carried no text.
slice::from_raw_parts requires a non-null pointer even for a zero
length, so ccxr_levenshtein_dist() was undefined behaviour there.
Debug builds abort on the precondition check (e.g. --tpages-all on
a teletext sample); release builds don't check it.

Build the slices through a helper that maps NULL to an empty slice,
and use it in ccxr_levenshtein_dist_char() too, which has the same
hazard.
@cfsmp3
cfsmp3 merged commit 4c03e90 into master Oct 18, 2026
47 of 49 checks passed
@cfsmp3
cfsmp3 deleted the fix/levenshtein-null-slice branch October 18, 2026 04:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant